Digital mobile radio

The DMR interface is defined by the following ETSI standards:

• TS 102 361-1: Air interface protocol
• TS 102 361-2: Voice and General services and facilities
• TS 102 361-3: Data protocol
• TS 102 361-4: Trunking protocol

The DMR standard operates within the existing 12.5 kHz channel spacing used in land mobile frequency bands globally, but achieves two voice channels through two-slot TDMA technology built around a 30 ms structure. The modulation is 4-state FSK, which creates four possible symbols over the air at a rate of 4,800 symbols/s, corresponding to 9,600 bit/s. After overhead, forward error correction, and splitting into two channels, there is 2,450 bit/s left for a single voice channel using DMR, compared to 4,400 bit/s using P25 and 64,000 bit/s with traditional telephone circuits.

The standards are still (as of late 2015) under development with revisions being made regularly as more systems are deployed and improvements are discovered.[http://dmrassociation.org/etsi-releases-new-version-of-dmr-trunking-standard/ DMR association press release Oct 27 2015 stating revision to standard] {{webarchive|url=https://web.archive.org/web/20151108162828/http://dmrassociation.org/etsi-releases-new-version-of-dmr-trunking-standard/ |date=2015-11-08 }} It is very likely that further refinements will be made to the standard, which will necessitate firmware upgrades to terminals and infrastructure in the future to take advantage of these new improvements, with potential incompatibility issues arising if this is not done.

DMR covers the RF range 30 MHz to 1 GHz.

There are DMR implementations, (as of early 2016), that operate as low as 66 MHz (within the European Union, in 'Lo-Band VHF' 66–88 MHz.) {{Citation needed|date=February 2016}}

DMR Tier I products are for licence-free use in the European PMR446 band. Tier I products are specified for non-infrastructure use only (meaning without the use of repeaters). This part of the standard provides for consumer applications and low-power commercial applications, using a maximum of 0.5 watts RF power.{{cite web |url=http://dmrassociation.org/manufacturers/ |title=DMR Association | Infrastructure and Mobile Terminals |access-date=2015-01-12 |url-status=dead |archive-url=https://web.archive.org/web/20150204064357/http://dmrassociation.org/manufacturers/ |archive-date=2015-02-04 }}

Note that a licence free allocation is not present at this frequency outside of Europe, which means that PMR446 radios including DMR Tier I radios can only be used legally in other countries once an appropriate radio licence is obtained by the operator.

Some DMR radios sold by Chinese manufacturers (most notably Baofeng) have been mis-labelled as DMR Tier I. A DMR Tier I radio would only use the PMR446 licence–free frequencies, and would have a maximum transmitted power of 0.5 watts as required by law for all PMR446 radios.{{cite web|title=A guide to the new PMR446 license-free radio frequencies following ECC Decision (15)05|url=http://kenwoodcommunications.co.uk/files/file/comms/uk/pmr446/PMR446-White-Paper-V6_18AUG2016_JT_KB.pdf|website=Kenwood|access-date=7 February 2018}}

Although the DMR standard allows Tier I DMR radios to use continuous transmission mode, all known Tier I radios currently use TDMA, the same as Tier II. This is probably due to the 40% battery savings that come with transmitting only half the time instead of continuously.{{cite web|title=Two-way radios and battery life|url=https://hytera-europe.com/uk/news/two-way-radios-and-battery-life|website=Hytera UK|access-date=19 October 2020}}

DMR Tier II covers licensed conventional radio systems, mobiles and hand portables operating in PMR frequency bands from 66–960 MHz.

The ETSI DMR Tier II standard is targeted at those users who need spectral efficiency, advanced voice features and integrated IP data services in licensed bands for high-power communications. A number of manufacturers have DMR Tier II compliant products on the market. ETSI DMR specifies two slot TDMA in 12.5 kHz channels for Tier II and III.{{Cite web|url=http://www.etsi.org/deliver/etsi_ts/102300_102399/10236101/02.04.01_60/ts_10236101v020401p.pdf|title=ETSI TS 102 361-1, DMR Air Interface PRotocol}}

File:DMR Tier 3 portable radio.jpg

DMR Tier III covers trunking operation in frequency bands 66–960 MHz. Tier III supports voice and short messaging handling similar to TETRA with built-in 128 character status messaging and short messaging with up to 288 bits of data in a variety of formats. It also supports packet data service in a variety of formats, including support for IPv4 and IPv6. Tier III compliant products were launched in 2012. In April 2013, Hytera participated in the completion of the DMR Tier III interoperability (IOP) test.{{cite web |title=DMR Association announces completion of three interoperability testing sessions | website=www.dmrassociation.org | url=https://www.dmrassociation.org/news/IOP-Hytera-Harris-Kirisun-04-2013.pdf | date=April 3, 2013}}

In 2005, a memorandum of understanding (MOU) was formed with potential DMR suppliers including Tait Communications, Fylde Micro, Selex, Motorola, Hytera, Sanchar Communication, Vertex Standard, Kenwood and Icom to establish common standards and interoperability. While the DMR standard does not specify the vocoder, MOU members agreed to use the half rate DVSI Advanced Multi-Band Excitation (AMBE) vocoder to ensure interoperability. In 2009, the MOU members set up the DMR Association to work on interoperability between vendors' equipment and to provide information about the DMR standard.{{cite web|url=http://www.dmrassociation.com |title=DMR Association}} Formal interoperability testing has been taking place since 2010. Results are published on the DMR Association web site. There are approximately 40 members of the DMR Association.

The standard allows DMR manufacturers to implement additional features on top of the standards which has led to practical non-interoperability issues between brands, in contravention to the DMR MOU.

DMR is used on the amateur radio VHF and UHF bands, started by DMR-MARC around 2010.{{Citation needed|date=June 2022}} The FCC officially approved the use of DMR by amateurs in the USA in 2014{{Citation needed|date=March 2025}}. In amateur spaces, Coordinated DMR Identification Numbers are assigned and managed by RadioID Inc. Their coordinated database can be uploaded to DMR radios in order to display the name, call sign, and location of other operators.{{Cite web|title=RadioID - Home|url=https://www.radioid.net/|access-date=2021-02-25|website=www.radioid.net}} Internet-linked systems such as [https://dvsph.net/ DV Scotland Phoenix Network], BrandMeister network, TGIF, FreeDMR, Ham United and several others (including several previously closed clusters which now connect to larger networks to facilitate wide-area accessibility), allow users to communicate with other users around the world via connected repeaters, or DMR "hotspots" often based on the Raspberry Pi single-board computer. There are currently more than 5,500 repeaters and 16,000 "hotspots" linked to the BrandMeister system worldwide.{{Cite web|title=Dashboard {{!}} BrandMeister|url=https://brandmeister.network/|access-date=2023-01-27|website=brandmeister.network}} The low-cost and increasing availability of internet-linked systems has led to a rise in DMR use on the amateur radio bands.{{Cite web|title=About Us|url=https://www.bridgecomsystems.com/pages/about-us|access-date=2021-02-25|website=BridgeCom Systems, Inc.|language=en}} Some Raspberry Pi-based DMR hotspots, often those running the Pi-Star or WPSD software, allow users to connect to multiple internet-linked DMR networks at the same time.{{cite web |title=Hotspots |url=https://www.dmrfordummies.com/hotspots/ |website=DMR For Dummies |access-date=14 June 2022}} DMR hotspots are often based on the open source Multimode Digital Voice Modem, or MMDVM, hardware with firmware developed by Jonathan Naylor.{{cite web |last1=Naylor |first1=Jonathan |title=g4klx (Jonathan Naylor) |url=https://github.com/g4klx/MMDVM |website=GitHub |access-date=14 June 2022}}{{cite web |title=MMDVM - Multi Mode Digital Voice Modem - VK3FS |url=https://3fs.net.au/glossary/mmdvm/ |website=VK3FS |access-date=14 June 2022}}

Encryption was not defined in the initial releases of the DMR standard, so each DMR radio manufacturer added its own encryption protocol. These early encryption protocols are therefore incompatible with each other. For example, Hytera's Basic Encrypt encryption is completely incompatible with Motorola's Basic Encrypt encryption or Tytera's Basic Encrypt encryption.

The DMRA now manages an interoperable voice and data encryption scheme for DMR. 40 Bit ARC4, 64 bit DES, 128 and 256 bit AES options are defined. These encryption schemes are interoperable between manufacturers and support voice call late entry, multiple keys, and with no discernible degradation of voice quality.{{Cite web |last=Bohn |first=Tom |date=March 30, 2023 |title=DMR Association DMR Feature Evolution |url=https://www.dmrassociation.org/public-downloads/documents/DMR_Association_DMR_Feature_Evolution.pdf |archive-url=https://web.archive.org/web/20240805211229/https://www.dmrassociation.org/public-downloads/documents/DMR_Association_DMR_Feature_Evolution.pdf |archive-date=Aug 5, 2024 |access-date=Aug 5, 2024 |website=DMR_Association_DMR_Feature_Evolution}}

Some DMR encryption algorithms have been released, such as PC4, released in 2015 with source code available.{{cite web |url=https://pastebin.com/A05PiNxH |website=Pastebin.com|title=PC4 encryption cipher source code}} PC4 is a block cipher specifically designed for DMR radio communication systems, using 253 rounds and a key size from 8 bits to 2112 bits. The block size is 49 bits, which is equal to the size of an AMBE+ DMR voice frame.

A firmware that implements PC4 encryption is available for the Tytera MD-380 and MD-390 radios.{{cite web |url=https://archive.org/details/voice-crypt-1.0a |website=Archive.org|year=2018 |title=Voice Crypt Firmware}}

In Motorola Basic Encryption, AMBE frames are encrypted by simple XOR using one of 255 possible static keys.{{cite web |url=https://github.com/travisgoodspeed/md380tools/blob/master/applet/src/aes.c |website=Github|year=2021 |title=Motorola Basic Encryption's analysis}}

The Basic mode from other manufacturers offers 10-, 32-, or 64-character keys to produce a 882-bit fixed string of random characters that is combined via XOR with AMBE frames. The entire superframe, rather than each individual AMBE frame, is XORed with this longer static key.

A superframe contains 18 AMBE frames, i.e. 882 bits, and it is these 882 bits that will be encrypted with this 882-bit fixed string.

PC4 encryption mode encrypts an entire 49-bit frame in ECB mode. A single bit that differs makes the entire encrypted block completely different.

For the Enhanced (ARC4) or Advanced (AES) mode, each complete superframe is also encrypted with a 32-bit IV (initialization vector).

As a result, the encryption is no longer fixed for the same key, but changes with each superframe, improving security.

In the DMR standard does not leave any room to store this IV, so the IV (with the addition of an error-correcting code, for a total of 72 bits) replaces 4 low-order bits in each 49-bit AMBE frame. These 4 bits are therefore lost, degrading the voice quality, which is not the case with fixed ciphers in Basic mode. The 72-bit encoded IV is thus spread across all 18 AMBE frames in the superframe.

Motorola has created its standard so that the 40-bit ARC4 (Alleged RC4) can withstand casual attackers. It is supposed to offer 40-bit security, where an attacker must test the 2 to the power of 40 possible keys to find the right one. This level of encryption offers no real protection and there is software that allows you to find the key.{{cite web|title=DMR ARC4 key finder|url=https://archive.org/details/arc4keyfinder}}

RC4 encryption is a stream cipher that must use an IV (Initialization_vector) each time it performs encryption. The size of this IV should be large enough so that there is no repetition of this IV during the entire use of the same key.

RC4 weak IV encryption have already been compromised in the WEP Wi-Fi encryption system because the IV size was too short (24 bits).

Motorola has opted to use a slightly longer IV size (32-bit) but not that much longer than the WEP's 24-bit IV. Motorola calls this IV the MI (Message Indicator).

Motorola's official explanation for this short IV, is that the DMR standard was not originally intended for encryption and that they had to use bits from voice frames to put the IV into it. To avoid degrading the voice too much, only 32 bits can be inserted.

According to the author of the DSD-FME software, a DMR specialist, this claim is false because there is the possibility of creating custom DMR frames. Such a frame could therefore have contained a large IV (128 bits for example).{{cite web |url=https://forums.radioreference.com/threads/dsd-fme.438137/page-38#post-3931141 |website=Radioreference.com|year=2023 |title=Create IVs without using voice frames}}

Some users discovered that Anytone radios (such as the Anytone 878) using ARC4, had the IV constant (0x12345678) at the beginning of each transmission.{{cite web |url=https://forums.radioreference.com/threads/anytone-878-rc4-and-aes.399070/#post-3234165 |website=Radioreference.com|year=2017 |title=Constant IV with the Anytone 878 in RC4 and AES.}}

This flaw was fixed in AnyTone D878UVII firmware update V3.03 (2023-12-18).: 5. Modify the firmware to make the AES encryption have a variable Vector(IV) instead of fixed "12345678".

The Motorola ARC4 DMRA should by design provide at least 4 billion different IVs, so there should be 4 billion superframes with a different IV (2^32-bits possible IVs).

But one user discovered that Motorola uses a non-primitive LFSR for the ARC4 to generate the IVs. The generator used x^32 + x^4 + x^2 + 1 is non-primitive and generates short cycles.

Instead of 4 billion different IVs, there are only 294903 different IVs. So instead of a 32-bit IV, you get an 18-bit IV, which is much shorter than the 24-bit WEP Wi-Fi IV.{{cite web |url=https://forums.radioreference.com/threads/i-found-a-bug-in-motorola-dmra-arc4.464874 |website=Radioreference.com|year=2023 |title=Non-primitive LFSR in ARC4 DMRA.}}

It doesn't seem conceivable that it was a mistake on Motorola's part to have used a non-primitive IV in its standard, so the mistake seems to be intentional.

It may be a backdoor. {{Citation needed|reason=This seems like speculation. Developers and standards bodies can and do make such mistakes routinely.|date=February 2025}}

If such a backdoor has been introduced in the ARC4 DMRA standard, one can wonder about the security of the AES256 DMRA standard, although no backdoor has been made public at the moment.

According to cryptologist Eric Filiol, it is likely that all exported products with a key length of more than 56 bits have a backdoor, as this is a legal requirement due to the Wassenaar Arrangement.{{cite web |url=https://www.theregister.com/2017/12/15/crypto_mathematical_backdoors |website=theregister.com|year=2017 |title=Interview with cryptologist Eric Filiol.}}{{cite web |url=https://www.blackhat.com/docs/eu-17/materials/eu-17-Filiol-By-Design-Backdooring-Of-Encryption-System-Can-We-Trust-Foreign-Encryption-Algorithms.pdf |website=blackhat.com|year=2017 |title=Backdoors analysis.}}

• dPMR
• D-STAR

{{reflist}}

• {{Cite web |date=2015-12-10 |title=FCC Modifies Amateur Service Testing and Emission Rules |url=https://www.fcc.gov/document/fcc-modifies-amateur-service-testing-and-emission-rules |access-date=2022-07-05 |website=Federal Communications Commission |language=en}}

• [https://www.dmrassociation.org/ DMR Association]
• [https://minnesotadmr.com/ MNDMR - Minnesota's First In-House DMR Repeater Network System]
• [https://radioid.net/ Radio ID, Inc.], Coordinated DMR Identification Numbers for Amateur Radio

{{Digital PMR standards}}

{{Trunked radio systems}}

Category:ETSI

Category:Mobile telecommunications standards

Category:Wireless communication systems